CVE-2026-78849

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-8447

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

EUVD-2026-71216

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

CVE-2026-77818

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-19057

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19057 Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

EUVD-2026-71101

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-77818

CVE-2026-77818 is a reflected HTML injection vulnerability in Yordam Informatics' Library Information and Document Automation Program (affects versions from v22.1 before v22.2 ), exploitable via form hijacking during web page generation. The vulnerability allows content spoofing and is rated CVSS...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom...

CVE-2026-85613

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-18957

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448...

RLSA-2026:63136 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive...

CVE-2026-85613

OpenPanel before 2.3.0 is vulnerable to an unauthenticated cross-site scripting (XSS) flaw in the favicon proxy endpoint GET /misc/favicon . An attacker can supply a URL pointing to a malicious SVG file with embedded scripts; when a victim's browser loads the proxy, the script executes on the API...

CVE-2026-85613 OpenPanel Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...